FreeBSD CVE-2026-49426

Exploitation requires local access to the FreeBSD system and the ability to attach via ptrace(2) to a target process using PT_SC_REMOTE. On FreeBSD, ptrace access requires either that the attacker owns the target process, or that the sysctl security.bsd.unprivileged_proc_debug is set to 1 (the default on many configurations), allowing any local user to debug processes they own. The attacker must be running a process they control and have not exceeded ptrace restrictions imposed by security policies such as Capsicum or MAC frameworks. The flaw is not remotely triggerable - physical or shell access to the system is a hard prerequisite. What limits exploitation: the impact is confined to audit log falsification with no direct system compromise; an attacker must already have established local access to exercise this capability; and environments that restrict ptrace via security.bsd.unprivileged_proc_debug=0 or Capsicum capability mode reduce the attacker surface to privileged accounts.

The aggregate risk signal is consistently low across all available indicators. CVSS 3.1 scores this at 3.3 with AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - local access with low-privilege requirement, limited integrity-only impact, and unchanged scope. EPSS corroborates this at 0.15% (5th percentile), well below any exploitation-trending threshold. There is no CISA KEV listing, no known public exploit code, and no POC referenced in the advisory. The attack prerequisite - holding ptrace capability against a target process - implies the attacker already has meaningful local access, which significantly narrows the realistic attacker population. The impact is strictly confined to audit log integrity: no privilege escalation, no data exfiltration, and no availability impact are possible through this flaw. The vulnerability is relevant primarily to environments using FreeBSD BSM audit trails as a compensating control or IDS data source; in those deployments, a falsified audit trail could mask post-exploitation activity. The CVSS vector and description are fully consistent with each other - no conflict between stated attack vector and described behavior. SSVC signals support a Defer or Scheduled remediation posture for most operators, with Track-and-patch being appropriate for security-sensitive FreeBSD deployments.

A local user with ptrace debugging capability attaches to a running process and uses PT_SC_REMOTE to inject system calls that intentionally fail - for example, attempting to open a sensitive file that will be denied. The BSM audit subsystem records each injected call as having succeeded, even though the kernel returned an error. A security analyst reviewing audit logs sees a clean record of successful operations, unaware that the attacker was probing the system, allowing post-exploitation reconnaissance to proceed without triggering audit-based IDS alerts. No public exploit code exists at time of analysis.